kuali edoclite and grouper for access forms workflow at penn 9-nov-2010, kuali days chris hyzer,...

Kuali eDoclite and Grouper for access Kuali eDoclite and Grouper for access forms workflow at Pennforms workflow at Penn

9-Nov-2010, Kuali DaysChris Hyzer, University of Pennsylvania developer

• eForms description• Integration with Grouper• Demo• Making an eForm• Production deployment• Future plans• Customizations• Documentation contributions• Wishlist

2 – 04/19/23, © 2009 Internet2

AgendaAgenda

eForms descriptioneForms description

• In 2009 Penn wanted to convert paper access management forms to eForms

4 – 04/19/23, © 2009 Internet2

Paper form screenshotPaper form screenshot

5 – 04/19/23, © 2009 Internet2

Paper form screenshot (continued)Paper form screenshot (continued)

9 – 04/19/23, © 2009 Internet2

Paper form existing listPaper form existing list

• Autofill personal information• Common includes (privacy statement)• Fill out form on behalf of someone else• Org chart picker for data access• Person picker from group (employee)• Notification to requester when complete• Report on form data• Should require no Java to create forms

10 – 04/19/23, © 2009 Internet2

RequirementsRequirements

• Route to members of Grouper group• Route to selected group (pick school)• Ability to return to previous route node• Route to multiple groups at once• Conditional routing• Dynamic routing to someone entered on

form

11 – 04/19/23, © 2009 Internet2

Routing requirementsRouting requirements

• Submitters can see current and past forms

• Approvers can see current and past forms

• Certain people can edit certain forms

12 – 04/19/23, © 2009 Internet2

Security requirementsSecurity requirements

• Not a current Kuali customer (will be with OLE Library system)

• Integrate Rice with Grouper (yummy)– 2, 3, 4 on google for “rice grouper”

• Use eDoclite• If gaps:

– Ajax (haven’t had to do this yet, but will)– External picker screens– Java customizations, e.g. post processors

• Meets the requirements

13 – 04/19/23, © 2009 Internet2

DesignDesign

Rice and Grouper integrationRice and Grouper integration

15 – 04/19/23, © 2009 Internet2

Kuali RiceKuali Rice•Middleware used by other Kuali and non-Kuali products•KIM: Kuali Identity Management•KSB: Kuali service bus•KEN: Kuali enterprise notification•KEW: Kuali enterprise workflow•Components

•UI•SOAP web services•Web framework•eDocLite: declarative workflow applications

16 – 04/19/23, © 2009 Internet2

Internet2 GrouperInternet2 Grouper•Access management middleware•Central groups and permissions store•Components

•UI•SOAP/Rest web services•Loader to load groups from source systems•Provisioning e.g. to LDAP or XMPP•Lightweight Java client

17 – 04/19/23, © 2009 Internet2

Internet2 Grouper advanced featuresInternet2 Grouper advanced features•Delegated privileges•Adhoc groups based on loaded groups (includes/excludes)•Composite groups: union, intersection, minus (e.g. require employee)•UI screen for simple group management (customizable, skinnable)•New in next release

•Rules, e.g. email when membership list changes, auto-deprovision•Point in time auditing, e.g. what groups has someone been in, who was a member 6 months ago•Manage federated members

18 – 04/19/23, © 2009 Internet2

Kuali Rice overridable servicesKuali Rice overridable services•Group service

•getMembers, hasMember, assignMember, etc•Identity service

•getPersonById, getPersonByPrincipal, etc•Permissions service•etc

19 – 04/19/23, © 2009 Internet2

How to connect Rice to Grouper?How to connect Rice to Grouper?•Add two jars to Rice (grouperRice.jar and grouperClient.jar)•Add and configure grouper.client.properties•Configure Rice spring override to group and/or identity service•Setup a Grouper folder for the “Rice root”

20 – 04/19/23, © 2009 Internet2

Kuali Rice overridable servicesKuali Rice overridable services

Ricerequest

grouperRice.jar

Kuali DB

Rice server

GrouperRegistry

Grouper WS server

Grouper.client.properties

grouperClient.jar

21 – 04/19/23, © 2009 Internet2

Grouper clientGrouper client

•One jar (no conflicts with existing libraries)•Supports all of Grouper WS API•Command line examplejava –jar grouperClient.jar --operation=hasMemberWs --groupName=aStem:aGroup --subjectIds=1234567

•Java library examplenew GcHasMember().assignGroupName("aStem:aGroup") .addSubjectId("1234567").execute();

Grouper WS serverGrouper.client.properties

grouperClient.jar

REST

LDAP

22 – 04/19/23, © 2009 Internet2

Grouper client continuedGrouper client continued•The debug flag shows XML (useful for examples)

23 – 04/19/23, © 2009 Internet2

Grouper client continuedGrouper client continued

24 – 04/19/23, © 2009 Internet2

eForms workflow with GroupereForms workflow with GrouperInitiator fills out form

GrouperRegistry

Kuali DB

Get members to route to and emails

Grouper WS

Routes to approver group

Routes to approver groupN

Final Add a member to a Grouper group/role and/or assign permissions

On login to Rice, get subject details

Archive the document data, and workflow history

One in groupapproves

1

3

4

5

Grouper UI

Person / org pickers2

25 – 04/19/23, © 2009 Internet2

KIM and Grouper differencesKIM and Grouper differences•KIM uses incrementor IDs and Grouper uses UUIDs

•Handled by not using any groups originating in Rice•KIM has a name for a group. Grouper has two names for a group, a system name, and a friendly name

•Handled by only using the system name•KIM services are largely driven by ID, the Grouper client generally used system name

•In Grouper 1.6, all client operations can use UUID •KIM has no namespace on subjects, Grouper has one level deep namespace for subjects (sourceId)

•Concatenate sourceId::::subjectId, e.g. pennperson::::12345678•KIM groups have active flags, not Grouper

•Inactive groups stored to grouper throw an exception

26 – 04/19/23, © 2009 Internet2

KIM and Grouper differences (continued)KIM and Grouper differences (continued)•KIM has one level deep namespace on Groups

•Designate “KIM” root folder in Grouper, which has one level deep folders inside, and groups in those folders

•KIM group desc is 4000 chars, Grouper is 1024 chars•Descriptions > 1024 will be abbrev to 1024 (with ellipses)

•KIM has operations for adding or updating a group. Grouper can add, update, or add_or_update a group

•The grouper add_or_update will not be used•KIM has operation to select multiple groups by ID

•This was added in Grouper•KIM has lookupIds method for criteria to return groupIds

•This is not [yet] implemented in Grouper •KIM can get groups for a subject only in one folder

•Grouper client and WS were enhanced to support this•KIM gets all or direct or indirect groups for a subject

•Grouper client and WS were enhanced to support this

27 – 04/19/23, © 2009 Internet2

KIM and Grouper differences (continued)KIM and Grouper differences (continued)•Kim gets immediate / non immediate members of group

•Grouper client and WS were enhanced to support this•KIM gets groups or people which are members of group

•Grouper client and WS were enhanced to support this•Kim could get the memberships of a group

•Grouper client and WS were enhanced to support this•Kim can create new groups in new namespaces

•Grouper added param "createParentStemsIfNotExist"•Kim caches group information for 30 seconds

•There is a 30 second propagation delay from Grouper to Kim•KIM has principalName, Grouper has subjectIdentifiers

•Configure attribute that is identifier for each applicable source in grouper.client.properties. Note not concatenated with the sourceId so it matches the principalName from the authn service

28 – 04/19/23, © 2009 Internet2

KIM and Grouper differences (continued)KIM and Grouper differences (continued)•KIM has principalId, the id of the principalName

•Grouper connector will use sourceId::::subjectIdentifier.•KIM has phone numbers, affiliations, etc.

•Grouper subjects have id, name, description and attributes. The connector assumes you configure at least the name, subjectIdentifier (principalName), and email address. Other stuff

will be blank in Kuali. •KIM has first, middle, and last name, Grouper has name.

•The connector splits the name into first, middle, and last•Kuali can have multiple names

•Grouper connector will set only one name per subject•Methods like getPrincipalByPrincipalNameAndPassword() are not applicable in Grouper and throw unimplemented exception•Others like search by params, are unimplemented, return no results.

29 – 04/19/23, © 2009 Internet2

Salary management eFormSalary management eForm

30 – 04/19/23, © 2009 Internet2

Salary management eForm (continued)Salary management eForm (continued)

31 – 04/19/23, © 2009 Internet2

Salary management eForm (continued)Salary management eForm (continued)

32 – 04/19/23, © 2009 Internet2

eForms demo workfloweForms demo workflowInitiator fills out form If on behalf of someone else, they need to

approve it, unless it is a ‘remove access’ 1

4

Supervisor (person picker)

2On behalf of

remove?

3

NoYes

Grouper group selected from available schools

Note: supervisor cannot be thesame as ‘On behalf of’

School admin

HR

Payroll

HR and payroll could approve in parallel in future

8 Operations Grant access that isn’t automatically provisioned

Change KEW initiator to ‘on behalf of’ user

7 Data admin Assert that form is valid

9 Data admin Assert that privileges were granted correctly

Final Send email to ‘on behalf of’ user10

5

6

33 – 04/19/23, © 2009 Internet2

Grouper Rice demoGrouper Rice demo•Demo movie

http://www.youtube.com/watch?v=CXWyPS1QOAc

http://www.youtube.com/watch?v=CXWyPS1QOAc

Making an eFormMaking an eForm

35 – 04/19/23, © 2009 Internet2

Make an eFormMake an eForm•Attributes•Rule templates•Doctype

•Settings and security•Route nodes and rules•Route paths

•eDocLite•Screen fields•HTML via XSL

•Email template

36 – 04/19/23, © 2009 Internet2

Attributes Attributes – in this case for dynamic routing– in this case for dynamic routing<?xml version="1.0" encoding="UTF-8"?>

<ruleAttributes>

<ruleAttribute>

<name>salaryManagementAccessForm.onBehalfOfPennId</name>

<xmlElementLabel>onBehalfOfPennId</xmlElementLabel>

</ruleAttribute>

<ruleAttribute>

<name>salaryManagementAccessForm.supervisorPennIdRoleAttribute</name>

<xmlElementLabel>supervisorPennId</xmlElementLabel>

</ruleAttribute>

<ruleAttribute>

<name>salaryManagementAccessForm.groupName</name>

<description>Supervisor selects the group name who is the third approver</description>

<xmlElementLabel>groupName</xmlElementLabel>

</ruleAttribute>

</ruleAttributes>

Note: XML not complete

37 – 04/19/23, © 2009 Internet2

Rule templates Rule templates – group of rules– group of rules<?xml version="1.0" encoding="UTF-8"?>

<ruleTemplates>

<ruleTemplate name="salaryManagementAccessForm.onBehalfOfRuleTemplate">

<attribute>salaryManagementAccessForm.onBehalfOfPennId</attribute>

</ruleTemplate>

<ruleTemplate name="salaryManagementAccessForm.supervisorRuleTemplate">

<attribute>salaryManagementAccessForm.supervisorPennIdRoleAttribute</attribute>

</ruleTemplate>

<ruleTemplate name="salaryManagementAccessForm.basRuleTemplate2">

<attribute>salaryManagementAccessForm.groupName</attribute>

</ruleTemplate>

<ruleTemplate name="salaryManagementAccessForm.hrReviewRuleTemplate"/>

<ruleTemplate name="salaryManagementAccessForm.payrollReviewRuleTemplate"/>

<ruleTemplate name="salaryManagementAccessForm.daReviewRuleTemplate"/>

<ruleTemplate name="salaryManagementAccessForm.implementorRuleTemplate"/>

<ruleTemplate name="salaryManagementAccessForm.daImplementRuleTemplate"/>

</ruleTemplates>

Note: XML not complete or correct

38 – 04/19/23, © 2009 Internet2

Doctype Doctype – settings and security– settings and security<?xml version="1.0" encoding="UTF-8"?>

<documentType name="salaryManagementAccessForm">

<postProcessorName>GrouperEdocliteDatabasePostProcessor</postProcessorName>

<superUserGroupName namespace="financialBalances">financialBalancesAdmins</superUserGroupName>

<security routeLogAuthenticated="true">

<groupName namespace="etc">kualiAdmins</groupName>

<groupName namespace="formReaders">HumanResourcesReaders</groupName>

</security>

…

<simpleNode name="emailNode">

<from>[email protected]</from>

<testAddress>[email protected]</testAddress>

<to>initiator</to>

<style>salaryManagementAccessForm.emailInitiatorTemplate</style>

<type>org.kuali.rice.kew.mail.EmailNode</type>

</simpleNode>


39 – 04/19/23, © 2009 Internet2

Doctype Doctype – route nodes and rules– route nodes and rules <routeNodes>

<start name="Initiated" />

<split name="routeOnBehalfSplit" type="RemoveGoRightSplitNode" />

<simple name="rightNoOpNode" type="NoOpNode" />

<requests name="leftOnBehalfOfNode">

<ruleTemplate>salaryManagementAccessForm.onBehalfOfRuleTemplate</ruleTemplate>

</requests>

<join name="kimJoin" />

<requests name="supervisorNode" ruleTemplate="supervisorRuleTemplate" />

<requests name="basNode" ruleTemplate="basRuleTemplate2" />

<requests name="hrNode" ruleTemplate="hrReviewRuleTemplate" />

<requests name="payrollNode" ruleTemplate="payrollReviewRuleTemplate" />

<requests name="daReviewNode" ruleTemplate="daReviewRuleTemplate" />

<requests name="seoNode" ruleTemplate="implementorRuleTemplate" />

<requests name="daImplementNode" ruleTemplate="daImplementRuleTemplate"/>


40 – 04/19/23, © 2009 Internet2

Doctype Doctype – route paths– route paths<routePath>

<start name="Initiated" nextNode="routeOnBehalfSplit" />

<split name="routeOnBehalfSplit" nextNode="supervisorNode">

<branch name="leftBranch">

<requests name="leftOnBehalfOfNode" nextNode="kimJoin" />

</branch>

<branch name="rightBranch">

<simple name="rightNoOpNode" nextNode="kimJoin" />

</branch>

<join name="kimJoin" />

</split>

<requests name="supervisorNode" nextNode="basNode" />

<requests name="basNode" nextNode="hrNode" />

<requests name="hrNode" nextNode="payrollNode" />

<requests name="payrollNode" nextNode="daReviewNode" />

<requests name="daReviewNode" nextNode="seoNode" />

<requests name="seoNode" nextNode="daImplementNode" />

<requests name="daImplementNode" nextNode="emailNode" />

<simple name="emailNode" />

</routePath>Note: XML not complete or correct

41 – 04/19/23, © 2009 Internet2

eDocLite eDocLite – link attributes with screen fields– link attributes with screen fields <edl name="salaryManagementAccessForm.form" title="Salary Management">

<attributes>

<attribute name="salaryManagementAccessForm.onBehalfOfPennId">

<field attributeField="principalId" edlField="onBehalfOfPennId" />

</attribute>

<attribute name="salaryManagementAccessForm.supervisorPennIdRoleAttribute">

<field attributeField="principalId" edlField="supervisorPennId" />

</attribute>

<attribute name="salaryManagementAccessForm.groupName">

<field attributeField="workgroupName" edlField="groupName" />

</attribute>

</attributes>


42 – 04/19/23, © 2009 Internet2

eDocLite eDocLite – define all screen fields– define all screen fields <fieldDef name="onBehalfOfPennId" title="On behalf of UserId">

<display type="text" size="15" />

</fieldDef>

<fieldDef name="onBehalfOfDescription" title="On behalf of Description">

<display type="textarea" rows="2" cols="100" />

<validation required="true">Please find your supervisor</validation>

</fieldDef>

<fieldDef name="privilegeChange" title="Privilege change">

<display type="radio" />

<values title="New ID">add</values>

<values title="Change privs">update</values>

<values title="Remove privs">remove</values>

<validation required="true">Please select 'Privilege change'</validation>

</fieldDef>

…


43 – 04/19/23, © 2009 Internet2

eDocLite eDocLite – XSL variables– XSL variables<xsl:variable name="actionable" select="/documentContent/documentState/actionable" />

<xsl:variable name="docHeaderId" select="/documentContent/documentState/docId" />

<xsl:variable name="editable" select="/documentContent/documentState/editable" />

<xsl:variable name="globalReadOnly" select="/documentContent/documentState/editable != 'true'" />

<xsl:variable name="docStatus" select="//documentState/workflowDocumentState/status" />

<xsl:variable name="isAtInitiated" select="my-class:isAtNode($docHeaderId, 'Initiated')" />

<xsl:variable name="isDaReview" select="my-class:isAtNode($docHeaderId, 'daReviewNode')" />

Note: XML not complete

44 – 04/19/23, © 2009 Internet2

eDocLite eDocLite – custom Javascript validations– custom Javascript validations//get the value from the privilege change radio button

var privilegeChange = $('input[name=privilegeChange]:checked').val();

//if we are updating or removing, then the oracle ID is required

if (privilegeChange == 'update' || privilegeChange == 'remove') {

if (riceIsBlank($('input[type=text][name=oracleId]').val())) {

alert('Please enter the Oracle ID that needs to be ' + privilegeChange + 'd');

return false;

}

}

Note: uses jquery

45 – 04/19/23, © 2009 Internet2

eDocLite eDocLite – screen HTML with XSL variables– screen HTML with XSL variables<xsl:template>

…

<tr>

<td class="fieldLabel">Expiration date (yyyy-Mon-dd)</td>

<td valign="top" class="fieldAsterisk"></td>

<td class="fieldInfo" id="expirationDateFieldInfoId">

<xsl:call-template name="widget_render">

<xsl:with-param name="fieldName" select="'expirationDate'" />

<xsl:with-param name="renderCmd" select="'input'" />

<xsl:with-param name="readOnly" select="$isPastInitiated" />

</xsl:call-template>

</td>

</tr>

…

<xsl:call-template name="supervisorRows" /> 

…

<xsl:template>

46 – 04/19/23, © 2009 Internet2

eDocLite eDocLite – associate style, def, doctype– associate style, def, doctype <association>

<docType>salaryManagementAccessForm</docType>

<definition>salaryManagementAccessForm.form</definition>

<style>salaryManagementAccessForm.style</style>

<active>true</active>

</association>

</edoclite>

47 – 04/19/23, © 2009 Internet2

eDocLite eDocLite – rules– rules<rule name="salaryManagementAccessForm.onBehalfOfRule">

<ruleTemplate>onBehalfOfRuleTemplate</ruleTemplate>



<responsibility role="PrincipalIdRoleAttribute!principalId" />

</rule>

<rule name="salaryManagementAccessForm.basRule">

<ruleTemplate>basRuleTemplate2</ruleTemplate>

<description>Route to financial balances bas</description>

<forceAction>true</forceAction> 



<responsibility role="WorkgroupRoleAttribute!workgroupName" />

</rule>

<rule name="salaryManagementAccessForm.hrReviewRule">

<ruleTemplate>hrReviewRuleTemplate</ruleTemplate>

<responsibility>



<groupName namespace="approvers">HumanResources</groupName>

</responsibility>

</rule>Note: not complete or correct XML

48 – 04/19/23, © 2009 Internet2

eDocLite eDocLite – email template for initiator when final– email template for initiator when final<style name="salaryManagementAccessForm.emailInitiatorTemplate">

<xsl:template match="emailNode">

<email>

<subject>Salary Management Data Warehouse Access <xsl:value-of select="*/routeHeaderId" /></subject>

<body>

You now have access to the Salary Management data collection in the Warehouse.

Your ID, for the Data Warehouse and Business Objects, is: <xsl:value-of select="*/version[@current='true']/field[@name='oracleIdAssigned']/value" />

…

Note: note complete XML

49 – 04/19/23, © 2009 Internet2

Setup or re-use groups in GrouperSetup or re-use groups in Grouper

50 – 04/19/23, © 2009 Internet2

Setup or re-use groups in GrouperSetup or re-use groups in Grouper (continued)(continued)

51 – 04/19/23, © 2009 Internet2

Setup or re-use groups in Grouper - continuedSetup or re-use groups in Grouper - continued

•Create a group•Allow the Rice grouperClient user to READ members•Add members (usually ~2 for approvers, one primary, one backup)•Grant privileges if self managed (maybe the approvers can delegate to others)

•If so, send the link to the Grouper simple management UI for the group

52 – 04/19/23, © 2009 Internet2

Setup or re-use groups in Grouper - continuedSetup or re-use groups in Grouper - continued

•Send link for simple membership UI to editors

53 – 04/19/23, © 2009 Internet2

Make an eForm - summaryMake an eForm - summary•Lots of XML to write•Lots of copy/paste (don’t mess that part up, could affect existing forms)•Not too hard•Could be time consuming and require an expert for troubleshooting•Penn only uses central data administration to manage the forms (no one else can use the ingester)

Penn production deploymentPenn production deployment

55 – 04/19/23, © 2009 Internet2

Penn statsPenn stats•26 forms in “soft launch”, users can use paper or eForms•Live for 1 month•A few dozen eForms initiated•A dozen users•A few user comments that we are incorporating (included in this presentation)•Lots of interest to expand the conversion of paper forms to eForms

56 – 04/19/23, © 2009 Internet2

Penn internal guidelinesPenn internal guidelines•Keep all parts of form in CVS

•CVS is the system of record (cannot get XML out of Rice)

•Naming standard for all parts•Starts with unique camel-case prefix, e.g.salaryManagementAccessForm.• Note, the doctype should just be salaryManagementAccessForm since user sees it

57 – 04/19/23, © 2009 Internet2

CVS screenshot of formsCVS screenshot of forms

58 – 04/19/23, © 2009 Internet2

CVS screenshot of form historyCVS screenshot of form history•Note, this could be subversion, or whatever

59 – 04/19/23, © 2009 Internet2

Our copy of Rice is in CVSOur copy of Rice is in CVS

60 – 04/19/23, © 2009 Internet2

Separate out customized filesSeparate out customized files

61 – 04/19/23, © 2009 Internet2

Externalize parts that change per envExternalize parts that change per env

62 – 04/19/23, © 2009 Internet2

Ant script generates four warfilesAnt script generates four warfiles•Warfiles for local dev, integrated dev, test, prod•Once the tomcat is setup (5.5, config stub in /conf with password, encryption files, etc)•Similar to this document•Each tar.gz has a different kualiRice.war in it

https://spaces.internet2.edu/display/grouper/Managing+Grouper+in+several+environments

Future plansFuture plans

64 – 04/19/23, © 2009 Internet2

Future plansFuture plans•More code generation to ease form creation•Convert more access management forms•Roll-out a service for other schools in the University

•Not sure how this will be structured

CustomizationsCustomizations

66 – 04/19/23, © 2009 Internet2

Change “Route” button textChange “Route” button text•Our users didn’t know what “route” meant, vs. “save”•We changed “route” to “submit”, and put an alert on “save” and “save note”

67 – 04/19/23, © 2009 Internet2

Change Save alertChange Save alert•Our users didn’t know that Save doesn’t Route•We put an alert on “save” and “save note”•Note: we should probably clarify “disapprove” and “return to previous” similarly…

68 – 04/19/23, © 2009 Internet2

Link to My SubmissionsLink to My Submissions•Would be nice to have a link to My Submissions from static HTML

•Similar to links to start documents, or action list

69 – 04/19/23, © 2009 Internet2

Link to My Submissions (continued)Link to My Submissions (continued)•Just add a JSP to kuali webapp

70 – 04/19/23, © 2009 Internet2

Generate parts of eDocLiteGenerate parts of eDocLite•Supports up to 50 orgs, all be defined

71 – 04/19/23, © 2009 Internet2

Generate parts of eDocLiteGenerate parts of eDocLite•Generate HTML for orgs

72 – 04/19/23, © 2009 Internet2

Generate “custom tag” with Java in XSLGenerate “custom tag” with Java in XSL•Screenshot

73 – 04/19/23, © 2009 Internet2

Generate “custom tag” with Java in XSLGenerate “custom tag” with Java in XSL•Generate HTML for orgs (java source)

74 – 04/19/23, © 2009 Internet2

Generate “custom tag” with Java in XSL (continued)Generate “custom tag” with Java in XSL (continued)

•Generate HTML for orgs (XSL)

75 – 04/19/23, © 2009 Internet2

Pickers from external applicationsPickers from external applicationsOn eDoclite

External application

Press ‘Select’ on popup

Javascript in the edoclitesets the ‘readonly’ fields

Popup.close()Note: a variable is passed to the picker and back so the Javascript knows which fields to set. Can have multiple person pickers on the same screen.

1

3

3a

3b

Rice eDocLite

Press button for popup2

Submit GET to edoclite HTML page that calls javascript opener.handle(), due to browser restrictions

Note: this is a lot simpler if the external application is hosted on the same URL base as eDocLite…

Note: another issue, ahem…

76 – 04/19/23, © 2009 Internet2

Authentication service overrideAuthentication service override•More flexible with SSO•Requires Grouper group (e.g. active Penn member)

77 – 04/19/23, © 2009 Internet2

Immediate and daily email notificationsImmediate and daily email notifications•Penn wants immediate notifications on action items•If an item is more than one day old, send daily email

78 – 04/19/23, © 2009 Internet2

Immediate and daily email notifications Immediate and daily email notifications (continued)(continued)•Make a view to hold people to send to

•Note: sometimes there are orphans in krew_actn_itm_t

•From FINAL docs•From CANCELLED docs•We manually delete them from the table

79 – 04/19/23, © 2009 Internet2

Remove title column from search resultsRemove title column from search results•For eDocLite only Rice deployments, this col is redundant

80 – 04/19/23, © 2009 Internet2

On behalf of vs. initiatorOn behalf of vs. initiator•Access management admins would like on behalf of to be initiator… for ‘my forms’, searching, results lists, etc

81 – 04/19/23, © 2009 Internet2

Message to user when buttons pressedMessage to user when buttons pressed•eDocLite by default shows a readonly screen (confusing)

•(granted if exceptions happen, might not be accurate )•Several pieces to make this happen… threadlocal for request, and request parameters… and the XSL logic

82 – 04/19/23, © 2009 Internet2

Add vs. remove branch codeAdd vs. remove branch code•If ‘remove’ then ‘on behalf of’ doesn’t approve form•Doctype:

•Java

•Note: would be nice to be able to do this without Java

83 – 04/19/23, © 2009 Internet2

Group and permission provisioning to GrouperGroup and permission provisioning to Grouper•When eForm is complete, initiator can be automatically granted group memberships or permissions in Grouper•Doctype:

•Or, to not save in database also:

•Note: would be nice to be able attach multiple post processors to pick and choose…

84 – 04/19/23, © 2009 Internet2

Group provisioning to Grouper (continued)Group provisioning to Grouper (continued)•Example screenshot of form

85 – 04/19/23, © 2009 Internet2

Group provisioning to Grouper (continued)Group provisioning to Grouper (continued)•Configure in the grouper config file

86 – 04/19/23, © 2009 Internet2

Group provisioning to Grouper (continued)Group provisioning to Grouper (continued)•Result is initiator is in group, and optional email sent to admins

87 – 04/19/23, © 2009 Internet2

Permission provisioning to Grouper Permission provisioning to Grouper (continued)(continued)

•Sample screenshot

88 – 04/19/23, © 2009 Internet2


•Note, you can provision groups and permissions in same form•Configure in the grouper config file for roles to provision

89 – 04/19/23, © 2009 Internet2


•Configure in the grouper config file for operation to provision

•Note, had to add enhancement of “replace” as a Grouper permissions web service operation…

Documentation contributionsDocumentation contributions

95 – 04/19/23, © 2009 Internet2

Doc additions – quick startDoc additions – quick start•Windows / Mysql quick start•Linux / Oracle quick start

98 – 04/19/23, © 2009 Internet2

Doc additions – eDocLite example (continued)Doc additions – eDocLite example (continued)

104 – 04/19/23, © 2009 Internet2


•These examples work start to finish•Would be nice to get contributions like this from other users

105 – 04/19/23, © 2009 Internet2

Doc additions – service overridesDoc additions – service overrides

•The group and entity service overrides of the Grouper KIM connector are open source, can be used as examples•All the design and discussion is on the Grouper KIM connector wiki

WishlistWishlist

107 – 04/19/23, © 2009 Internet2

Penn’s eDoclite wishlistPenn’s eDoclite wishlist(most things have been discussed with Kuali team and might be Jiras)Note: things might exist already, and I don’t know about them•Workflow GUI•Improved security•Fewer silent failures

•E.g. in a mail node is in non prod and doesn’t have testAddress, then it silently doesn’t send the email•E.g. if route to inputted user is not quite correct, the user data will be blank, and skips that node•E.g. XSL you do <xsl:when test="($userAction) == 'initiate'">instead of: <xsl:when test="($userAction) = 'initiate'">java.lang.NullPointerException at org.kuali.rice.kew.edl.EDLControllerChain .renderEDL(EDLControllerChain.java:50)

108 – 04/19/23, © 2009 Internet2

Penn’s eDoclite wishlist (continued)Penn’s eDoclite wishlist (continued)•Dynamic split node that doesn’t require Java

•Maybe I will contribute this?•On upgrade from 1.0.1 to 1.0.2.1, Grouper connector broke due to Rice API changes, prefer backwards compatible•The Rice ingester sometimes has orphaned rules / templates / etc. Nice to be able to replace with ingester•Sometimes orphans in krew_actn_itm_t, nice to have daemon to clean it up (erroneous daily emails)•Would be nice if search screens had default sort order (e.g. eDocLite search could default to sort by document type)•Would be nice of all overridable services had good Javadoc•Would be nice if Document Operation Screen were better documented including examples

109 – 04/19/23, © 2009 Internet2

Penn’s Email / Jira requestsPenn’s Email / Jira requests•51 emails to rice-collab, all answered•13 Jira’s initiated, 5 closed

Phew…. We made it…Phew…. We made it…

Kuali eDoclite and Grouper for Kuali eDoclite and Grouper for access forms workflow at Pennaccess forms workflow at Penn9-Nov-2010, Kuali DaysChris Hyzer, University of Pennsylvania developer

For more information, visit www.internet2.edu

111 – 04/19/23, © 2009 Internet2

kuali edoclite and grouper for access forms workflow at penn 9-nov-2010, kuali days chris hyzer,...

Documents

internet2 agenda slide

internet2 design slide

internet2 requirements

grouper integration

internet2 routing requirements

kuali edoclite

form data

paper access management